pt-tls-client - Simple client using PT-TLS to collect integrity information

pt-tls-client  is  a  simple  client  using the PT-TLS (RFC 6876) transport protocol to collect integrity
       measurements on the client platform. PT-TLS does an initial TLS handshake with  certificate-based  server
       authentication and optional certificate-based client authentication.  Alternatively simple password-based
       SASL client authentication protected by TLS can be used.

       Attribute  requests  and  integrity measurements are exchanged via the PA-TNC (RFC 5792) message protocol
       between any number of Integrity Measurement Verifiers (IMVs) residing on the  remote  PT-TLS  server  and
       multiple  Integrity  Measurement Collectors (IMCs) loaded dynamically by the PT-TLS client according to a
       list defined by /etc/tnc_config. PA-TNC messages that  contain  one  or  several  PA-TNC  attributes  are
       multiplexed  into  PB-TNC  (RFC 5793) client or server data batches which in turn are transported via PT-
       TLS.

       Connect to a PT-TLS server using certificate-based authentication, storing the private  ECDSA  key  in  a
       file:

         pt-tls-client --connect pdp.example.com --cert ca.crt \
                       --cert client.crt --key client.key --key-type ecdsa

       Connect to a PT-TLS server using certificate-based authentication, storing the private key in a smartcard
       or a TPM 2.0 Trusted Platform Module:

         pt-tls-client --connect pdp.example.com --cert ca.crt \
                       --cert client.crt --keyid 0x81010002

       Connect to a PT-TLS server listening on port 443, using SASL password-based authentication:

         pt-tls-client --connect pdp.example.com --port 443 --cert ca.crt \
                       --client jane --password p2Nl9trKlb

       /etc/tnc_config

       pt-tls-client - Simple client using PT-TLS to collect integrity information

-h,--help
              Prints usage information and a short summary of the available commands.

       -c,--connecthostname|address
              Set the hostname or IP address of the PT-TLS server.

       -p,--portport
              Set the port of the PT-TLS server, default: 271.

       -x,--certfile
              Set the path to an X.509 certificate file. This option can be repeated to load multiple client and
              CA certificates.

       -X,--certidhex
              Set the handle of the certificate stored in a smartcard or a TPM 2.0 Trusted Platform Module.

       -k,--keyfile
              Set the path to the client's PKCS#1 or PKCS#8 private key file

       -t,--key-typetype
              Define the type of the private key if stored in PKCS#1 format. Can be omitted with PKCS#8 keys.

       -K,--keyidhex
              Set the keyid of the private key stored in a smartcard or a TPM 2.0 Trusted Platform Module.

       -i,--clientclient-id
              Set the username or client ID of the client required for password-based SASL authentication.

       -s,--secretpassword
              Set the preshared secret or client password required for password-based SASL authentication.

       -q,--mutual
              Enable mutual attestation between PT-TLS client and PT-TLS server.

       -v,--debuglevel
              Set debug level, default: 1.

       -q,--quiet
              Disable debug output to stderr.

       -+,--optionsfile
              Read command line options from file.

strongswan.conf(5)

5.9.13                                             2018-11-20                                   PT-TLS-CLIENT(1)

pt-tls-client--connecthostname|address [--portport] [--certidhex|--certfile]+ [--keyidhex|--keyfile] [--key-typersa|ecdsa] [--clientclient-id] [--secretpassword] [--mutual]
                     [--optionsfilename] [--quiet] [--debuglevel]

       pt-tls-client-h | --help